--- title: "Automating .NET Security Updates - Muhammad Rehan Saeed" description: ".NET SDK updates are released every few weeks. In this post, I talk about how you can automate them." canonical_url: "https://rehansaeed.com/automating-dotnet-security-updates/" last_updated: "2020-09-23T15:35:00+00:00" meta: author: "Muhammad Rehan Saeed" keywords: ".NET,.NET SDK,GitHub Actions,Azure Pipelines,AppVeyor" "og:description": ".NET SDK updates are released every few weeks. In this post, I talk about how you can automate them." "og:image": "https://rehansaeed.com/_og/s/o_ae5d99f0d768ae48.png" "og:image:alt": "Automating .NET Security Updates - Muhammad Rehan Saeed" "og:image:height": "630" "og:image:type": image/png "og:image:width": "1200" "og:title": "Automating .NET Security Updates" "twitter:image": "https://rehansaeed.com/_og/s/o_ae5d99f0d768ae48.png" "twitter:image:alt": "Automating .NET Security Updates - Muhammad Rehan Saeed" --- > Index of every page on this site: [llms.txt](https://rehansaeed.com/llms.txt) # [Automating .NET Security Updates](https://rehansaeed.com/automating-dotnet-security-updates/) Posted 23 September 2020 - **3 min read** ![Microsoft .NET](https://rehansaeed.com/_ipx/f_png&s_2560x1440/images/hero/Microsoft-.NET-1366x768.png) Every few weeks Microsoft pushes out a .NET SDK update to patch zero day security vulnerabilities. It's important to keep up to date with these to ensure that your software is protected. The problem is, keeping up to date is a manual and boring process but what if you could automate it? In this post, I'll talk through how you can get most of the way to a fully automated solution with the last hurdle requiring some of your help. # Link to this sectionSingle Source of Truth The first problem we need to solve is to enforce a specific version of the .NET SDK to be used to build our code. We can do this by adding a `global.json` file to the root of our repository. We can set the .NET SDK version in it like so: ```json { "sdk": { "version": "3.1.402" } } ``` Security vs Convenience If a developer doesn't have the version of the .NET SDK you've specified in your `global.json` file, Visual Studio will fail to load the projects and show a pretty good error in the output window telling you to update the SDK. It would be nice if it also contained a link to the exact SDK install you needed to smooth the experience. # Link to this sectionContinuous Integration Continuous integration servers like GitHub Actions, Azure Pipelines or AppVeyor all have a version of the .NET SDK pre-installed for your convenience. However, when a new version is released it takes them days to update to the latest version. In my opinion, it's just better to install the .NET SDK yourself, which is pretty easy to do. The trick is to read the .NET SDK version number from the `global.json` file, so that there is a single source of truth for the version number and it's easier to update. It's worth noting that this adds a few seconds to your build time. However, if the build server already has the version installed which is usually true, it's very quick. ## Link to this sectionGitHub Actions For GitHub Actions, we can use the first party `actions/setup-dotnet` GitHub action to install the .NET SDK. You can provide it a hard coded version number but it turns out omitting this causes it to lookup the version number from any `global.json` file it finds. ```yml - name: 'Install .NET Core SDK' uses: actions/setup-dotnet@v1 ``` ## Link to this sectionAzure Pipelines Azure Pipelines has a similar first party `UseDotNet` task that can install the .NET SDK. It's a bit more verbose, as you need to set the `useGlobalJson` flag to `true`. ```yml - task: UseDotNet@2 displayName: 'Install .NET Core SDK' inputs: packageType: 'sdk' useGlobalJson: true ``` ## Link to this sectionPowerShell .NET ships with a PowerShell and Bash script to install the .NET SDK. They both ship with an argument you can pass to tell them to use the `global.json` file to read the version number. Here is a short cross-platform PowerShell 7 (previously known as PowerShell Core) script that you can use: ```powershell if ($isWindows) { Invoke-WebRequest "https://dot.net/v1/dotnet-install.ps1" -OutFile "./dotnet-install.ps1" ./dotnet-install.ps1 -JSonFile global.json } else { Invoke-WebRequest "https://dot.net/v1/dotnet-install.sh" -OutFile "./dotnet-install.sh" sudo chmod u+x dotnet-install.sh sudo ./dotnet-install.sh --jsonfile global.json } ``` ## Link to this sectionAppVeyor AppVeyor has some issues with installing the .NET SDK using the PowerShell and Bash scripts. For reasons I'm not too clear on, you have to set the installation directory. So here is the updated script I use for that: ```powershell if ($isWindows) { Invoke-WebRequest "https://dot.net/v1/dotnet-install.ps1" -OutFile "./dotnet-install.ps1" ./dotnet-install.ps1 -JSonFile global.json -InstallDir 'C:\Program Files\dotnet' } else { Invoke-WebRequest "https://dot.net/v1/dotnet-install.sh" -OutFile "./dotnet-install.sh" sudo chmod u+x dotnet-install.sh if ($isMacOS) { sudo ./dotnet-install.sh --jsonfile global.json --install-dir '/Users/appveyor/.dotnet' } else { sudo ./dotnet-install.sh --jsonfile global.json --install-dir '/usr/share/dotnet' } } ``` # Link to this sectionDependabot [Dependabot](https://github.blog/2020-06-01-keep-all-your-packages-up-to-date-with-dependabot/) is an amazing tool that GitHub recently acquired. It automatically submits pull requests to your repository to update packages of various kinds including NuGet and NPM packages. This is where I need your help. The Dependabot GitHub repository has an open issue ([dependabot-core#2442](https://github.com/dependabot/dependabot-core/issues/2442)) to also do the same for the .NET SDK version in the `global.json` file. Upvoting the issue will really help raise it's profile and get it implemented. # Link to this sectionConclusions Security is hard. Keeping up to date is important but a never ending boring chore. It doesn't have to be that way. With a little extra work, we can get as close to making a .NET SDK update a three character commit every few weeks and with your help, maybe even that can be automated with Dependabot. ## Web Mentions [What's this?](https://en.wikipedia.org/wiki/Webmention) ### 0 Linked ### 0 Replies ## GitHub Comments ### 4 Comments [Comment on GitHub](https://github.com/RehanSaeed/rehansaeed.github.io/issues/196) [![mishrsud](https://avatars.githubusercontent.com/u/2586529?v=4)](https://github.com/mishrsud) ### [mishrsud](https://github.com/mishrsud) 24 September 2020 Great tip, Rehan, thanks for sharing! I usually build my .NET core projects in a docker container (e.g. mcr.microsoft.com/dotnet/core/sdk:3.1 image) - would it be fair to assume that these images (build and runtime) get updated when security patches are released? [![RehanSaeed](https://avatars.githubusercontent.com/u/2270364?v=4)](https://github.com/RehanSaeed) ### [RehanSaeed](https://github.com/RehanSaeed) Owner 24 September 2020 > Great tip, Rehan, thanks for sharing! > I usually build my .NET core projects in a docker container (e.g. mcr.microsoft.com/dotnet/core/sdk:3.1 image) - would it be fair to assume that these images (build and runtime) get updated when security patches are released? I half wrote something about Docker and then deleted it because the story is complex and I haven't thought it through. You could omit the patch version in the SDK Docker image tag and that would give you the latest patched image each time you did a `docker pull`. However, how do you know when a new base SDK image has been published? How can you start a build when that happens? I think the best solution to that problem is still Dependabot raising a PR and that being the instigator for a build. One alternative is to use a nightly build but the problem with this is that you'd get a **lot** of builds that are just the same as the night before. [![andresmoschini](https://avatars.githubusercontent.com/u/1157864?v=4)](https://github.com/andresmoschini) ### [andresmoschini](https://github.com/andresmoschini) 24 September 2020 > However, how do you know when a new base SDK image has been published? How can you start a build when that happens? Dependabot [supports Docker](https://dependabot.com/docker/) and can create PRs when a new SDK image is published. In my projects, I have deleted `global.json` and I am using Docker with Dependabot. --- BTW, I tried to comment directly on your page, but you are asking me too many permissions: [![image](https://user-images.githubusercontent.com/1157864/94160657-39988f80-fe5b-11ea-9337-6ee89f3da589.png)](https://user-images.githubusercontent.com/1157864/94160657-39988f80-fe5b-11ea-9337-6ee89f3da589.png) [![RehanSaeed](https://avatars.githubusercontent.com/u/2270364?v=4)](https://github.com/RehanSaeed) ### [RehanSaeed](https://github.com/RehanSaeed) Owner 24 September 2020 Ah yes, I forgot about that. Seems like a good alternative. There is a link where you can comment directly on GitHub if you don't like the permissions. I think I may just remove the ability to do that on my site directly. ```json {"@context":"https://schema.org","@graph":[{"@id":"https://rehansaeed.com/#website","@type":"WebSite","description":"Software Developer at Microsoft, YouTuber, Open Source Contributor and Blogger","inLanguage":"en-GB","name":"Muhammad Rehan Saeed","url":"https://rehansaeed.com/","author":{"@id":"https://rehansaeed.com/#identity"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://rehansaeed.com/?search={search_term_string}"},"query-input":"required name=search_term_string"}],"publisher":{"@id":"https://rehansaeed.com/#publisher"}},{"@id":"https://rehansaeed.com/automating-dotnet-security-updates/#webpage","@type":"WebPage","dateModified":"2020-09-23T15:35:00+00:00","datePublished":"2020-09-23T15:35:00+00:00","description":".NET SDK updates are released every few weeks. In this post, I talk about how you can automate them.","name":"Automating .NET Security Updates","url":"https://rehansaeed.com/automating-dotnet-security-updates/","breadcrumb":{"@id":"https://rehansaeed.com/automating-dotnet-security-updates/#breadcrumb"},"isPartOf":{"@id":"https://rehansaeed.com/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://rehansaeed.com/automating-dotnet-security-updates/"]}]},{"@id":"https://rehansaeed.com/#identity","@type":"Person","name":"Muhammad Rehan Saeed","url":"https://rehansaeed.com/about/","image":{"@id":"https://rehansaeed.com/#/schema/image/1"},"sameAs":["https://github.com/RehanSaeed","https://www.linkedin.com/in/muhammad-rehan-saeed","https://stackoverflow.com/users/1212017/muhammad-rehan-saeed","https://www.youtube.com/c/MuhammadRehanSaeed","https://www.twitch.tv/rehansaeeduk"]},{"@id":"https://rehansaeed.com/#publisher","@type":"Organization","logo":"https://rehansaeed.com/images/schema/Publisher-600x60.png","name":"Muhammad Rehan Saeed","url":"https://rehansaeed.com"},{"@id":"https://rehansaeed.com/automating-dotnet-security-updates/#article","@type":"Article","dateModified":"2020-09-23T15:35:00+00:00","datePublished":"2020-09-23T15:35:00+00:00","description":".NET SDK updates are released every few weeks. In this post, I talk about how you can automate them.","headline":"Automating .NET Security Updates","inLanguage":"en-GB","url":"https://rehansaeed.com/automating-dotnet-security-updates/","author":{"@id":"https://rehansaeed.com/#identity"},"image":[{"@type":"ImageObject","url":"https://rehansaeed.com/images/hero/Microsoft-.NET-1366x768.png","caption":"Microsoft .NET","width":"1366","height":"768"}],"isPartOf":{"@id":"https://rehansaeed.com/automating-dotnet-security-updates/#webpage"},"keywords":[".NET",".NET SDK","GitHub Actions","Azure Pipelines","AppVeyor"],"mainEntityOfPage":{"@id":"https://rehansaeed.com/automating-dotnet-security-updates/#webpage"},"publisher":{"@id":"https://rehansaeed.com/#publisher"}},{"@id":"https://rehansaeed.com/automating-dotnet-security-updates/#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Blog","item":"https://rehansaeed.com/","position":1},{"@type":"ListItem","name":"Automating .NET Security Updates","item":"https://rehansaeed.com/automating-dotnet-security-updates/","position":2}]},{"@id":"https://rehansaeed.com/#/schema/image/1","@type":"ImageObject","contentUrl":"https://rehansaeed.com/images/author/Muhammad-Rehan-Saeed/Logo-512x512.png","inLanguage":"en-GB","url":"https://rehansaeed.com/images/author/Muhammad-Rehan-Saeed/Logo-512x512.png"}]} ``` ## Sitemap See the full [sitemap](https://rehansaeed.com/sitemap.md) for all pages.